Security Bulletin: Vulnerabilities in wpa_supplicant affect PowerKVM (KRACK)

Summary

PowerKVM is affected by vulnerabilities in wpa_suppliacant. IBM has now addressed these vulnerabilities.

Vulnerability Details

CVEID: CVE-2017-13077**
DESCRIPTION:** Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2) protocols, as used in multiple products, could allow a remote attacker from within the local network to bypass security restrictions, caused by an error when processing the 802.11i 4-way handshake messages. By establishing a man-in-the-middle position between supplicant and authenticator, an attacker could manipulate the timing and transmission of messages to reinstall a pairwise encryption key (PTK-TK) in the 4-way handshake.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/133431 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2017-13078**
DESCRIPTION:** Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2) protocols, as used in multiple products, could allow a remote attacker from within the local network to bypass security restrictions, caused by an error when processing the 802.11i 4-way handshake messages. By establishing a man-in-the-middle position between supplicant and authenticator, an attacker could manipulate the timing and transmission of messages to reinstall a group key (GTK) in the 4-way handshake.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/133432 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2017-13080**
DESCRIPTION:** Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2) protocols, as used in multiple products, could allow a remote attacker from within the local network to bypass security restrictions, caused by an error when processing the 802.11i 4-way handshake messages. By establishing a man-in-the-middle position between supplicant and authenticator, an attacker could manipulate the timing and transmission of messages to reinstall a group key (GTK) in the group key handshake.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/133434 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2017-13082**
DESCRIPTION:** Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2) protocols, as used in multiple products, could allow a remote attacker from within the local network to bypass security restrictions, caused by an error when processing the 802.11i 4-way handshake messages. By establishing a man-in-the-middle position between supplicant and authenticator, an attacker could manipulate the timing and transmission of messages to reinstall the pairwise encryption key (PTK-TK) during the Fast BSS Transition (FT) handshake vulnerability.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/133436 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2017-13086**
DESCRIPTION:** Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2) protocols, as used in multiple products, could allow a remote attacker from within the local network to bypass security restrictions, caused by an error when processing the 802.11i 4-way handshake messages. By establishing a man-in-the-middle position between supplicant and authenticator, an attacker could manipulate the timing and transmission of messages to reinstall a Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/133438 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2017-13087**
DESCRIPTION:** Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2) protocols, as used in multiple products, could allow a remote attacker from within the local network to bypass security restrictions, caused by an error when processing the 802.11i 4-way handshake messages. By establishing a man-in-the-middle position between supplicant and authenticator, an attacker could manipulate the timing and transmission of messages to reinstall a group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/133439 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID: CVE-2017-13088**
DESCRIPTION:** Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2) protocols, as used in multiple products, could allow a remote attacker from within the local network to bypass security restrictions, caused by an error when processing the 802.11i 4-way handshake messages. By establishing a man-in-the-middle position between supplicant and authenticator, an attacker could manipulate the timing and transmission of messages to reinstall an integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/133440 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Affected Products and Versions

PowerKVM v3.1

Remediation/Fixes

Customers can update PowerKVM systems by using “yum update”.

Fix images are made available via Fix Central. See https://ibm.biz/BdHggw. This issue is addressed starting with v3.1.0.2 update 11.

Workarounds and Mitigations

none